

<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  
  <title>KMIP Integration &mdash; Ceph Documentation</title>
  

  
  <link rel="stylesheet" href="../../_static/ceph.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/graphviz.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/css/custom.css" type="text/css" />

  
  
    <link rel="shortcut icon" href="../../_static/favicon.ico"/>
  

  
  

  

  
  <!--[if lt IE 9]>
    <script src="../../_static/js/html5shiv.min.js"></script>
  <![endif]-->
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
        <script src="../../_static/jquery.js"></script>
        <script src="../../_static/underscore.js"></script>
        <script src="../../_static/doctools.js"></script>
    
    <script type="text/javascript" src="../../_static/js/theme.js"></script>

    
    <link rel="index" title="Index" href="../../genindex/" />
    <link rel="search" title="Search" href="../../search/" />
    <link rel="next" title="与 Open Policy Agent 对接" href="../opa/" />
    <link rel="prev" title="HashiCorp Vault Integration" href="../vault/" /> 
</head>

<body class="wy-body-for-nav">

   
  <header class="top-bar">
    

















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="../../" class="icon icon-home"></a> &raquo;</li>
        
          <li><a href="../">Ceph 对象网关</a> &raquo;</li>
        
      <li>KMIP Integration</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
          
            <a href="../../_sources/radosgw/kmip.rst.txt" rel="nofollow"> View page source</a>
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
  </header>
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search"  style="background: #eee" >
          

          
            <a href="../../">
          

          
            
            <img src="../../_static/logo.png" class="logo" alt="Logo"/>
          
          </a>

          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../../search/" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        
        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../start/intro/">Ceph 简介</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../install/">安装 Ceph</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../cephadm/">Cephadm</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../rados/">Ceph 存储集群</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../cephfs/">Ceph 文件系统</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../rbd/">Ceph 块设备</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../">Ceph 对象网关</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../frontends/">HTTP 前端</a></li>
<li class="toctree-l2"><a class="reference internal" href="../placement/">存储池归置与存储类</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multisite/">多站配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multisite-sync-policy/">多站同步策略配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../pools/">存储池的配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../config-ref/">配置参考</a></li>
<li class="toctree-l2"><a class="reference internal" href="../admin/">管理指南</a></li>
<li class="toctree-l2"><a class="reference internal" href="../s3/">S3 API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../rgw-cache/">Data caching and CDN</a></li>
<li class="toctree-l2"><a class="reference internal" href="../swift/">Swift API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../adminops/">管理操作 API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../api/">Python 接口</a></li>
<li class="toctree-l2"><a class="reference internal" href="../nfs/">通过 NFS 导出</a></li>
<li class="toctree-l2"><a class="reference internal" href="../keystone/">与 OpenStack Keystone 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../barbican/">与 OpenStack Barbican 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../vault/">与 HashiCorp Vault 对接</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">KMIP Integration</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#setting-kmip-access-for-ceph">Setting KMIP Access for Ceph</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#using-ibm-sklm">Using IBM SKLM</a></li>
<li class="toctree-l4"><a class="reference internal" href="#using-pykmip">Using PyKMIP</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#creating-keys-in-kmip">Creating Keys in KMIP</a></li>
<li class="toctree-l3"><a class="reference internal" href="#configure-the-ceph-object-gateway">Configure the Ceph Object Gateway</a></li>
<li class="toctree-l3"><a class="reference internal" href="#upload-object">Upload object</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../opa/">与 Open Policy Agent 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multitenancy/">多租户</a></li>
<li class="toctree-l2"><a class="reference internal" href="../compression/">压缩</a></li>
<li class="toctree-l2"><a class="reference internal" href="../ldap-auth/">LDAP 认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../encryption/">服务器端加密</a></li>
<li class="toctree-l2"><a class="reference internal" href="../bucketpolicy/">桶策略</a></li>
<li class="toctree-l2"><a class="reference internal" href="../dynamicresharding/">动态的桶索引重分片</a></li>
<li class="toctree-l2"><a class="reference internal" href="../mfa/">多因子认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../sync-modules/">同步模块</a></li>
<li class="toctree-l2"><a class="reference internal" href="../notifications/">Bucket Notifications</a></li>
<li class="toctree-l2"><a class="reference internal" href="../layout/">RADOS 中的数据布局</a></li>
<li class="toctree-l2"><a class="reference internal" href="../STS/">STS</a></li>
<li class="toctree-l2"><a class="reference internal" href="../STSLite/">STS Lite</a></li>
<li class="toctree-l2"><a class="reference internal" href="../keycloak/">Keycloak</a></li>
<li class="toctree-l2"><a class="reference internal" href="../role/">Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="../session-tags/">Session Tags</a></li>
<li class="toctree-l2"><a class="reference internal" href="../orphans/">Orphan List and Associated Tooliing</a></li>
<li class="toctree-l2"><a class="reference internal" href="../oidc/">OpenID Connect Provider</a></li>
<li class="toctree-l2"><a class="reference internal" href="../troubleshooting/">故障排除</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../man/8/radosgw/">radosgw 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../man/8/radosgw-admin/">radosgw-admin 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../qat-accel/">使用 QAT 为加密和压缩提速</a></li>
<li class="toctree-l2"><a class="reference internal" href="../s3select/">S3-select</a></li>
<li class="toctree-l2"><a class="reference internal" href="../lua-scripting/">Lua Scripting</a></li>
<li class="toctree-l2"><a class="reference internal" href="../d3n_datacache/">D3N Data Cache</a></li>
<li class="toctree-l2"><a class="reference internal" href="../cloud-transition/">Cloud Transition</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../mgr/">Ceph 管理器守护进程</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../mgr/dashboard/">Ceph 仪表盘</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../api/">API 文档</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../architecture/">体系结构</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev/developer_guide/">开发者指南</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev/internals/">Ceph 内幕</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../governance/">项目管理</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../foundation/">Ceph 基金会</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../ceph-volume/">ceph-volume</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../releases/general/">Ceph 版本（总目录）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../releases/">Ceph 版本（索引）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../security/">Security</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../glossary/">Ceph 术语</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../jaegertracing/">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../translation_cn/">中文版翻译资源</a></li>
</ul>

            
          
        </div>
        
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../../">Ceph</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
<div id="dev-warning" class="admonition note">
  <p class="first admonition-title">Notice</p>
  <p class="last">This document is for a development version of Ceph.</p>
</div>
  <div id="docubetter" align="right" style="padding: 5px; font-weight: bold;">
    <a href="https://pad.ceph.com/p/Report_Documentation_Bugs">Report a Documentation Bug</a>
  </div>

  
  <div class="section" id="kmip-integration">
<h1>KMIP Integration<a class="headerlink" href="#kmip-integration" title="Permalink to this headline">¶</a></h1>
<p><a class="reference external" href="http://www.oasis-open.org/committees/kmip/">KMIP</a> can be used as a secure key management service for
<a class="reference external" href="../encryption">Server-Side Encryption</a> (SSE-KMS).</p>
<ol class="arabic simple">
<li><p><a class="reference internal" href="#setting-kmip-access-for-ceph">Setting KMIP Access for Ceph</a></p></li>
<li><p><a class="reference internal" href="#creating-keys-in-kmip">Creating Keys in KMIP</a></p></li>
<li><p><a class="reference internal" href="#configure-the-ceph-object-gateway">Configure the Ceph Object Gateway</a></p></li>
<li><p><a class="reference internal" href="#upload-object">Upload object</a></p></li>
</ol>
<p>Before you can use KMIP with ceph, you will need to do three things.
You will need to associate ceph with client information in KMIP,
and configure ceph to use that client information.
You will also need to create 1 or more keys in KMIP.</p>
<div class="section" id="setting-kmip-access-for-ceph">
<h2>Setting KMIP Access for Ceph<a class="headerlink" href="#setting-kmip-access-for-ceph" title="Permalink to this headline">¶</a></h2>
<p>Setting up Ceph in KMIP is very dependent on the mechanism(s) supported
by your implementation of KMIP.  Two implementations are described
here,</p>
<ol class="arabic simple">
<li><p><a class="reference external" href="https://www.ibm.com/products/ibm-security-key-lifecycle-manager">IBM Security Guardium Key Lifecycle Manager (SKLM)</a>.  This is a well
supported commercial product.</p></li>
</ol>
<ol class="arabic simple" start="2">
<li><p><a class="reference external" href="https://pykmip.readthedocs.io/en/latest/">PyKMIP</a>.  This is a small python project, suitable for experimental
and testing use only.</p></li>
</ol>
<div class="section" id="using-ibm-sklm">
<h3>Using IBM SKLM<a class="headerlink" href="#using-ibm-sklm" title="Permalink to this headline">¶</a></h3>
<p>IBM <a class="reference external" href="https://www.ibm.com/products/ibm-security-key-lifecycle-manager">SKLM</a> supports client authentication using certificates.
Certificates may either be self-signed certificates created,
for instance, using openssl, or certificates may be created
using SKLM.  Ceph should then be configured (see below) to
use KMIP and an attempt made to use it.  This will fail,
but it will leave an “untrusted client device certificate” in SKLM.
This can be then upgraded to a registered client using the web
interface to complete the registration process.</p>
<p>Find untrusted clients under <code class="docutils literal notranslate"><span class="pre">Advanced</span> <span class="pre">Configuration</span></code>,
<code class="docutils literal notranslate"><span class="pre">Client</span> <span class="pre">Device</span> <span class="pre">Communication</span> <span class="pre">Certificates</span></code>.  Select
<code class="docutils literal notranslate"><span class="pre">Modify</span> <span class="pre">SSL/KMIP</span> <span class="pre">Certificates</span> <span class="pre">for</span> <span class="pre">Clients</span></code>, then toggle the flag
<code class="docutils literal notranslate"><span class="pre">allow</span> <span class="pre">the</span> <span class="pre">server</span> <span class="pre">to</span> <span class="pre">trust</span> <span class="pre">this</span> <span class="pre">certificate</span> <span class="pre">and</span> <span class="pre">communicate...</span></code>.</p>
</div>
<div class="section" id="using-pykmip">
<h3>Using PyKMIP<a class="headerlink" href="#using-pykmip" title="Permalink to this headline">¶</a></h3>
<p><a class="reference external" href="https://pykmip.readthedocs.io/en/latest/">PyKMIP</a> has no special registration process, it simply
trusts the certificate.  However, the certificate has to
be issued by a certificate authority that is trusted by
pykmip.  PyKMIP also prefers that the certificate contain
an extension for “extended key usage”.  However, that
can be defeated by specifying <code class="docutils literal notranslate"><span class="pre">enable_tls_client_auth=False</span></code>
in the server configuration.</p>
</div>
</div>
<div class="section" id="creating-keys-in-kmip">
<h2>Creating Keys in KMIP<a class="headerlink" href="#creating-keys-in-kmip" title="Permalink to this headline">¶</a></h2>
<p>Some KMIP implementations come with a web interface or other
administrative tools to create and manage keys.  Refer to your
documentation on that if you wish to use it.  The KMIP protocol can also
be used to create and manage keys.  PyKMIP comes with a python client
library that can be used this way.</p>
<p>In preparation to using the pykmip client, you’ll need to have a valid
kmip client key &amp; certificate, such as the one you created for ceph.</p>
<p>Next, you’ll then need to download and install it:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>virtualenv $HOME/my-kmip-env
source $HOME/my-kmip-env/bin/activate
pip install pykmip
</pre></div>
</div>
<p>Then you’ll need to prepare a configuration file
for the client, something like this:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>cat &lt;&lt;EOF &gt;$HOME/my-kmip-configuration
[client]
host={hostname}
port=5696
certfile={clientcert}
keyfile={clientkey}
ca_certs={clientca}
ssl_version=PROTOCOL_TLSv1_2
EOF
</pre></div>
</div>
<p>You will need to replace {hostname} with the name of your kmip host,
also replace {clientcert} {clientkey} and {clientca} with pathnames to
a suitable pem encoded certificate, such as the one you created for
ceph to use.</p>
<p>Now, you can run this python script directly from
the shell:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">python</span>
<span class="kn">from</span> <span class="nn">kmip.pie</span> <span class="kn">import</span> <span class="n">client</span>
<span class="kn">from</span> <span class="nn">kmip</span> <span class="kn">import</span> <span class="n">enums</span>
<span class="kn">import</span> <span class="nn">ssl</span>
<span class="kn">import</span> <span class="nn">os</span>
<span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">json</span>
<span class="n">c</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">ProxyKmipClient</span><span class="p">(</span><span class="n">config_file</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s1">&#39;HOME&#39;</span><span class="p">]</span><span class="o">+</span><span class="s2">&quot;/my-kmip-configuration&quot;</span><span class="p">)</span>

<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
  <span class="n">l</span><span class="o">=</span><span class="n">sys</span><span class="o">.</span><span class="n">stdin</span><span class="o">.</span><span class="n">readline</span><span class="p">()</span>
  <span class="n">keyname</span><span class="o">=</span><span class="n">l</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span>
  <span class="k">if</span> <span class="n">keyname</span> <span class="o">==</span> <span class="s2">&quot;&quot;</span><span class="p">:</span> <span class="k">break</span>
  <span class="k">with</span> <span class="n">c</span><span class="p">:</span>
    <span class="n">key_id</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">create</span><span class="p">(</span>
        <span class="n">enums</span><span class="o">.</span><span class="n">CryptographicAlgorithm</span><span class="o">.</span><span class="n">AES</span><span class="p">,</span>
        <span class="mi">256</span><span class="p">,</span>
        <span class="n">operation_policy_name</span><span class="o">=</span><span class="s1">&#39;default&#39;</span><span class="p">,</span>
        <span class="n">name</span><span class="o">=</span><span class="n">keyname</span><span class="p">,</span>
        <span class="n">cryptographic_usage_mask</span><span class="o">=</span><span class="p">[</span>
            <span class="n">enums</span><span class="o">.</span><span class="n">CryptographicUsageMask</span><span class="o">.</span><span class="n">ENCRYPT</span><span class="p">,</span>
            <span class="n">enums</span><span class="o">.</span><span class="n">CryptographicUsageMask</span><span class="o">.</span><span class="n">DECRYPT</span>
        <span class="p">]</span>
    <span class="p">)</span>
    <span class="n">c</span><span class="o">.</span><span class="n">activate</span><span class="p">(</span><span class="n">key_id</span><span class="p">)</span>
    <span class="n">attrs</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">get_attributes</span><span class="p">(</span><span class="n">uid</span><span class="o">=</span><span class="n">key_id</span><span class="p">)</span>
    <span class="n">r</span> <span class="o">=</span> <span class="p">{}</span>
    <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="n">attrs</span><span class="p">[</span><span class="mi">1</span><span class="p">]:</span>
     <span class="n">r</span><span class="p">[</span><span class="nb">str</span><span class="p">(</span><span class="n">a</span><span class="o">.</span><span class="n">attribute_name</span><span class="p">)]</span> <span class="o">=</span> <span class="nb">str</span><span class="p">(</span><span class="n">a</span><span class="o">.</span><span class="n">attribute_value</span><span class="p">)</span>
    <span class="nb">print</span> <span class="p">(</span><span class="n">json</span><span class="o">.</span><span class="n">dumps</span><span class="p">(</span><span class="n">r</span><span class="p">))</span>
</pre></div>
</div>
<p>If this is all entered at the shell prompt, python will
prompt with “&gt;&gt;&gt;” then “…” until the script is read in,
after which it will read and process names with no prompt
until a blank line or end of file (^D) is given it, or
an error occurs.  Of course you can turn this into a regular
python script if you prefer.</p>
</div>
<div class="section" id="configure-the-ceph-object-gateway">
<h2>Configure the Ceph Object Gateway<a class="headerlink" href="#configure-the-ceph-object-gateway" title="Permalink to this headline">¶</a></h2>
<p>Edit the Ceph configuration file to enable Vault as a KMS backend for
server-side encryption:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>rgw crypt s3 kms backend = kmip
rgw crypt kmip ca path: /etc/ceph/kmiproot.crt
rgw crypt kmip client cert: /etc/ceph/kmip-client.crt
rgw crypt kmip client key: /etc/ceph/private/kmip-client.key
rgw crypt kmip kms key template: pykmip-$keyid
</pre></div>
</div>
<p>You may need to change the paths above to match where
you actually want to store kmip certificate data.</p>
<p>The kmip key template describes how ceph will modify
the name given to it before it looks it up
in kmip.  The default is just “$keyid”.
If you don’t want ceph to see all your kmip
keys, you can use this to limit ceph to just the
designated subset of your kmip key namespace.</p>
</div>
<div class="section" id="upload-object">
<h2>Upload object<a class="headerlink" href="#upload-object" title="Permalink to this headline">¶</a></h2>
<p>When uploading an object to the Gateway, provide the SSE key ID in the request.
As an example, for the kv engine, using the AWS command-line client:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">aws</span> <span class="o">--</span><span class="n">endpoint</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">radosgw</span><span class="p">:</span><span class="mi">8000</span> <span class="n">s3</span> <span class="n">cp</span> <span class="n">plaintext</span><span class="o">.</span><span class="n">txt</span> \
<span class="n">s3</span><span class="p">:</span><span class="o">//</span><span class="n">mybucket</span><span class="o">/</span><span class="n">encrypted</span><span class="o">.</span><span class="n">txt</span> <span class="o">--</span><span class="n">sse</span><span class="o">=</span><span class="n">aws</span><span class="p">:</span><span class="n">kms</span> <span class="o">--</span><span class="n">sse</span><span class="o">-</span><span class="n">kms</span><span class="o">-</span><span class="n">key</span><span class="o">-</span><span class="nb">id</span> <span class="n">mybucketkey</span>
</pre></div>
</div>
<p>As an example, for the transit engine, using the AWS command-line client:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">aws</span> <span class="o">--</span><span class="n">endpoint</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">radosgw</span><span class="p">:</span><span class="mi">8000</span> <span class="n">s3</span> <span class="n">cp</span> <span class="n">plaintext</span><span class="o">.</span><span class="n">txt</span> \
<span class="n">s3</span><span class="p">:</span><span class="o">//</span><span class="n">mybucket</span><span class="o">/</span><span class="n">encrypted</span><span class="o">.</span><span class="n">txt</span> <span class="o">--</span><span class="n">sse</span><span class="o">=</span><span class="n">aws</span><span class="p">:</span><span class="n">kms</span> <span class="o">--</span><span class="n">sse</span><span class="o">-</span><span class="n">kms</span><span class="o">-</span><span class="n">key</span><span class="o">-</span><span class="nb">id</span> <span class="n">mybucketkey</span>
</pre></div>
</div>
<p>The Object Gateway will fetch the key from Vault, encrypt the object and store
it in the bucket. Any request to download the object will make the Gateway
automatically retrieve the correspondent key from Vault and decrypt the object.</p>
<p>Note that the secret will be fetched from kmip using a name constructed
from the key template, replacing <code class="docutils literal notranslate"><span class="pre">$keyid</span></code> with the key provided.</p>
<p>With the ceph configuration given above,
radosgw would fetch the secret from:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pykmip</span><span class="o">-</span><span class="n">mybucketkey</span>
</pre></div>
</div>
</div>
</div>



           </div>
           
          </div>
          <footer>
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
        <a href="../opa/" class="btn btn-neutral float-right" title="与 Open Policy Agent 对接" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
        <a href="../vault/" class="btn btn-neutral float-left" title="HashiCorp Vault Integration" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
    </div>

  <hr/>

  <div role="contentinfo">
    <p>
        &#169; Copyright 2016, Ceph authors and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0).

    </p>
  </div> 

</footer>
        </div>
      </div>

    </section>

  </div>
  

  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>